SSF-207 Deep-linking for view orders and view assigned pantries

apps/backend/src/orders/order.controller.ts

@@ -46,6 +46,7 @@ export class OrdersController {
   // Called like: /?status=pending&pantryName=Test%20Pantry&pantryName=Test%20Pantry%202
   // %20 is the URL encoded space character
   // This gets all orders where the status is pending and the pantry name is either Test Pantry or Test Pantry 2
+  @Roles(Role.ADMIN)
   @Get('/')
   async getAllOrders(
     @Query('status') status?: string,

apps/backend/src/orders/order.service.ts

@@ -117,6 +117,7 @@ export class OrdersService {
         createdAt: o.createdAt,
         shippedAt: o.shippedAt,
         deliveredAt: o.deliveredAt,
+        pantryId: o.request.pantryId,
         pantryName: o.request.pantry.pantryName,
         assignee: o.assignee,
         actionCompletion,
@@ -157,6 +158,7 @@ export class OrdersService {
       createdAt: o.createdAt,
       shippedAt: o.shippedAt,
       deliveredAt: o.deliveredAt,
+      pantryId: o.request.pantryId,
       pantryName: o.request.pantry.pantryName,
       assignee: o.assignee,
     }));

apps/backend/src/volunteers/types.ts

@@ -9,6 +9,7 @@ export type VolunteerOrder = {
   createdAt: Date;
   shippedAt: Date | null;
   deliveredAt: Date | null;
+  pantryId: number;
   pantryName: string;
   assignee: OrderAssignee;
   actionCompletion?: VolunteerActionCompletion;

apps/backend/src/volunteers/volunteers.controller.ts

@@ -3,6 +3,7 @@ import { Pantry } from '../pantries/pantries.entity';
 import { VolunteersService } from './volunteers.service';
 import { Role } from '../users/types';
 import { Roles } from '../auth/roles.decorator';
+import { CheckOwnership } from '../auth/ownership.decorator';
 import { Assignments, VolunteerOrder } from './types';
 import { AuthenticatedRequest } from '../auth/authenticated-request';
 import { OrdersService } from '../orders/order.service';
@@ -49,6 +50,10 @@ export class VolunteersController {
 
   // returns all orders globally
   // only includes actionCompletion for orders assigned to the requesting volunteer
+  @CheckOwnership({
+    idParam: 'id',
+    resolver: async ({ entityId }) => [entityId],
+  })
   @Roles(Role.VOLUNTEER)
   @Get('/:id/orders')
   async getVolunteerOrders(